99% of UK gov websites are breaking the law

Most have no idea how much they are violating

Common Topics

Most public sector organisations do not ask internet users' consent to cookie tracking, a survey has said.

The UK's Privacy and Electronic Communications (Amendment) Regulations implement changes to EU law and were brought into effect in May. The new law requires website operators to make sure they have "informed consent" from users for the use of cookies.

Cookies are small text files that websites store on users' computers. The files contain information about users' online activity.

Only six out of 603 public sector websites audited were found to be compliant with the regulations, the report by the Society for Local Authority IT Managers (Socitm) said. Socitm is an independent organisation funded through the membership of local government IT workers.

Martin Greenwood, Socitm Insight programme manager, said: "We audited about 600 local public sector websites including all local authorities and police, fire and housing websites and a few others and had a look to see how many cookies are on the sites," Greenwood said.

Socitm's research, which was conducted using special automated search technology operated by Cookie Reports Ltd, found that on average English county council websites had 186 cookies, while Scottish council sites had 86, Greenwood said. He said that organisations grossly underestimated the number of cookies that their websites use.

"We found that there are far more cookies on these sites than those organisations thought. We did not know what the size of the problem would be before hand so we asked organisations how many cookies they thought they had and the best guess was 19 per cent of the actual total," Greenwood said.

The UK's privacy watchdog, the Information Commissioner's Office (ICO), which is charged with ensuring organisations comply with the new cookie regulations, has previously said organisations were being given a year to find ways to obtain "informed consent" from users to cookie-use before it will properly enforce the regulations. It has the power to issue fines of up to £500,000 for serious breaches of the laws.

The ICO has previously issued guidance on how websites can comply with the new cookie laws. It said that websites can obtain consent through a number of methods, including asking users to consent through screen prompts. Less obstructive methods, such as obtaining consent from websites' terms and conditions or users' preference settings were also deemed appropriate by the ICO.

A spokesperson for the ICO told OUT-LAW that it was up to individual organisations to work out which technical method is best suitable for obtaining users' consent.

"By next May we expect businesses and organisations to have clear information about the way in which cookies are operating on their websites and to be obtaining consent to set those cookies," an ICO statement said.

"Exactly how far each organisation will need to go in getting consent will depend on exactly what the purpose of the cookie is. Certainly, having widely available and easily understood information that is relevant to users is fundamental. Our work on helping people to comply with the new rules is ongoing. We have published initial advice but we never intended that would be the end of it. We are very interested in how businesses and organisations are working towards solutions," the statement said.

Socitm's Greenwood said that organisations have quite a lot to do before they comply with the UK regulations but that it was "realistic" that they can be in a position of compliance by May next year. Socitm will send a report detailing its findings to all the public sector website operators it audited along with a guide on options for inform the public about cookies, Greenwood said. Website operators will have to pay Socitm for information on the exact location of the cookies Socitm found.

The government is working with Mozilla, Apple, Microsoft, Google, Yahoo, Adobe and the Internet Advertising Bureau to deliver an efficient technological solution to obtaining users' consent, the Department for Culture, Media and Sport (DCMS) told OUT-LAW in May.

In June, the European Commission set a deadline for European companies to create a uniform way for web users to opt out of being tracked by cookies within a year. The Commission has said it will take action if industry does not standardise opt-outs in that time.